C++: Use new getConvSpecString instead of getConvSpecOffset and substring

[jketema]

Should address glibc timeout in BMN DCA.

Three DCA experiments in order of occurrence (of open issues):

• BMN using the last known working nightly SHA-pair as a base: has a lot of changes, but shows that glibc is working again,
• BMN with just the change: glibc obviously fails, these experiments seem quite noisy, but I see no reason for concern that this PR regresses anything
• Traced: looks good, I do see that I did not quite manage to stabilize nmap; the tinyxml2 analysis time difference we've only seen in nightlies, so is not an immediate reason for concern.

Please ignore the Custom Sources DCA experiment(s), and other closed experiment issues.

[geoffw0]

I like this, it's quite clean for what it accomplishes. 👍

[Copilot]

Pull request overview

This PR updates the C++ printf/scanf format-string parsing helpers to extract conversion-specifier substrings via a new getConvSpecString helper, avoiding offset+substring usage in the parsing predicates (intended to address a glibc timeout seen in BMN DCA).

Changes:

• Add getConvSpecString(int n) helper to both Scanf.qll and Printf.qll.
• Update conversion-spec parsing to operate on the new extracted substring (convSpec) rather than substring(offset, ...).

Show a summary per file

File	Description
cpp/ql/lib/semmle/code/cpp/commons/Scanf.qll	Introduces getConvSpecString and uses it in parseConvSpec to avoid offset+substring extraction.
cpp/ql/lib/semmle/code/cpp/commons/Printf.qll	Introduces getConvSpecString and uses it in parseConvSpec and getConvSpec to avoid offset+substring extraction.

Copilot's findings

• Files reviewed: 2/2 changed files
• Comments generated: 2